Title: [136286] branches/chromium/1312
- Revision
- 136286
- Author
- [email protected]
- Date
- 2012-11-30 15:17:14 -0800 (Fri, 30 Nov 2012)
Log Message
Merge 136060
BUG=158693
Review URL: https://codereview.chromium.org/11416300
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1312/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt (from rev 136060, trunk/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt) (0 => 136286)
--- branches/chromium/1312/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt 2012-11-30 23:17:14 UTC (rev 136286)
@@ -0,0 +1,3 @@
+Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
+Test passes if it does not crash.
+
Copied: branches/chromium/1312/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html (from rev 136060, trunk/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html) (0 => 136286)
--- branches/chromium/1312/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html 2012-11-30 23:17:14 UTC (rev 136286)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer<br />
+Test passes if it does not crash.<br />
+<div id="container">
+ <q>
+ <q id="test1"></q>
+ </q>
+ <q id="test2">
+ <q style="float: left"></q>
+ <q id="test3">
+ <q style="position: fixed;">
+ </q>
+ </q>
+</div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+document.body.offsetTop;
+test3.style.display = "table-footer-group";
+test3.focus();
+test1.style.display = "table-row-group";
+test2.style.display = "inline-block";
+</script>
+</html>
Modified: branches/chromium/1312/Source/WebCore/rendering/RenderBlock.cpp (136285 => 136286)
--- branches/chromium/1312/Source/WebCore/rendering/RenderBlock.cpp 2012-11-30 23:12:15 UTC (rev 136285)
+++ branches/chromium/1312/Source/WebCore/rendering/RenderBlock.cpp 2012-11-30 23:17:14 UTC (rev 136286)
@@ -675,6 +675,7 @@
// We can reuse this block and make it the preBlock of the next continuation.
pre = block;
pre->removePositionedObjects(0);
+ pre->removeFloatingObjects();
block = toRenderBlock(block->parent());
} else {
// No anonymous block available for use. Make one.
@@ -3761,6 +3762,15 @@
removePositionedObject(deadObjects.at(i));
}
+void RenderBlock::removeFloatingObjects()
+{
+ if (!m_floatingObjects)
+ return;
+
+ deleteAllValues(m_floatingObjects->set());
+ m_floatingObjects->clear();
+}
+
RenderBlock::FloatingObject* RenderBlock::insertFloatingObject(RenderBox* o)
{
ASSERT(o->isFloating());
Modified: branches/chromium/1312/Source/WebCore/rendering/RenderBlock.h (136285 => 136286)
--- branches/chromium/1312/Source/WebCore/rendering/RenderBlock.h 2012-11-30 23:12:15 UTC (rev 136285)
+++ branches/chromium/1312/Source/WebCore/rendering/RenderBlock.h 2012-11-30 23:17:14 UTC (rev 136286)
@@ -112,6 +112,8 @@
static void removePositionedObject(RenderBox*);
void removePositionedObjects(RenderBlock*);
+ void removeFloatingObjects();
+
TrackedRendererListHashSet* positionedObjects() const;
bool hasPositionedObjects() const
{
Modified: branches/chromium/1312/Source/WebCore/rendering/RenderInline.cpp (136285 => 136286)
--- branches/chromium/1312/Source/WebCore/rendering/RenderInline.cpp 2012-11-30 23:12:15 UTC (rev 136285)
+++ branches/chromium/1312/Source/WebCore/rendering/RenderInline.cpp 2012-11-30 23:17:14 UTC (rev 136286)
@@ -455,6 +455,7 @@
// We can reuse this block and make it the preBlock of the next continuation.
pre = block;
pre->removePositionedObjects(0);
+ pre->removeFloatingObjects();
block = block->containingBlock();
} else {
// No anonymous block available for use. Make one.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
